The CitMo components were boxed as mobile applications from Russian Sberbank and Alfa-Bank, and popular social network VKontakte. When installed, the CitMo component would work quietly in the background.

The researchers discovered the backdoored apps last Wednesday, informed Google about them, and was removed from the market on Thursday.